- Normalize and verify launcher, AppDir, and GTK hook permissions before and after repacking.
- Reject unsupported target triples before deriving or deleting payload paths.
- Align the published AppImage filename with catalog discovery and document the host glibc floor.
- Add regression coverage for permission, layout, symlink, and target traversal failures.